The web is not anonymous

Originally published July 28, 2002.

You've probably all heard about the 'anonymity' of the Internet. Apparently, criminals and terrorists can use the net for whatever dire plans they may have and get away with it. Whenever a web site asks you for your name, you can enter any name you wish to enter, because your identity can't be checked anyway. Even in online chats, you can assume any persona, because no-one can figure out who you really are.

Thought so? Well, I've got bad news for you. The web is not anonymous. Everyone who wants to find out what you're doing online can do so.

Or they might perhaps find out things that you didn't do, but thought you were doing. A recent article in The New York Times (registration required) pointed out what web life is like in the age of Google and other highly efficient search engines. Everything that's on a web page about you somewhere, everything you posted on a newsgroup can be tracked, and can and will, under certain circumstances, be used against you. Or, as an expert quoted in the NYTimes article says, "Many people assume they are a needle in a haystack, simply a face in the crowd. But the minute someone takes an interest in you, the search tool is what allows the rest of the crowd to dissolve."

Indeed, Google has turned many people into open books. Only those with very generic names have some sort of protection. And those with highly individual names might accidentally become victims of something that a namesake has written or posted somewhere. The NYTimes has this story about a man who was told by an online date that they were incompatible; he later found out that she had run a search on his name, come across a posting by his son and assumed he had posted it.

But web search engines are just the tip of the iceberg. From the moment your computer connects to the Internet to the moment you disconnect, everything you do is logged on a server somewhere. When you connect you are assigned an IP number, and whatever you do, that IP number is sent along with every action you take. A person I met online was was really spooked when I asked her what exactly she was working as at the Vienna University of Technology. She asked me how I knew she worked there; she had never mentioned it. I sent her the Internet mail header of her last e-mail, and even though she had used a Hotmail service rather than the university's mail server, it clearly showed exactly which computer at the university she had used.

Even if you use one of the web anonymizer services widely available on the web, you should always bear in mind that you still will not be totally anonymous -- as all you requests are passing through the anonymizer, it can (and probably will) keep a record of what you're doing.

There is, of course, no need to panic. With the multitude of data generated daily in log files, it is currently quite tedious work to filter out a person's online activity; while it can be done, it will be done only in exceptional cases.

The Google trap is, however, a more real problem. More than ever it is important to take care what you are writing on web pages, online forums and newsgroups. Google's algorithm is so efficient that you can't really hide from it. I once accidentally found out something about a friend's sexual orientation; now I am quite tolerant and don't have a problem, but I still feel like I shouldn't really know it, and I don't know what other people that entered his name in Google thought when they saw what I saw.

Which leads me to a couple of things...

• Remember that everything you post online, everything that you put on a web page, is a public announcement (interestingly, the Austrian copyright law treats a web page as a "public performance". This may seem odd at first, but does make a lot of sense in hindsight). If you wouldn't walk onto the nearest marketplace and proclaim the same thing with a megaphone, then don't post it online.
• UseNet netiquette generally requires using your own name. It also requires that you do not post anything you wouldn't say in a public or person-to-person situation, so if you follow netiquette, there shouldn't be a problem. However, if you think you'll be embarrassed in a couple of years when your posts on alt.tv.ally-mcbeal are discovered, you can circumvent this by using a newsreader that allows you to enter your own news headers and insert "X-No-Archive: yes" as an additional header. In that case, your UseNet posts should not be archived and disappear once they have expired from the news server.
• Be aware that online petitions are by definition public and that everyone (including your employer) can draw conclusions on your political or religious beliefs from them. Be aware that even some written petitions may appear online. Now while the declaration of human rights gives every person protection against discrimination for political or religious beliefs, it is a well-known fact that discrimination on whatever basis (racial, sexual, political, etc.) is quite common in our world.
• If you want to participate in newsgroups and online forums that touch upon matters that you do not wish to be publicly known about you (e.g. sexual orientation), don't use your real name. But be aware that your IP number has most likely been recorded, so you should not write anything that might trigger somebody's interest enough to start investigations about the person behind the IP number.

Please get this right -- I'm not trying to make you paranoid or saying that you shouldn't use the Internet. I'm just saying that you should always see the net as a "public performance", because that's what is is.

The opinions expressed here are those of Horst Prillinger and his only. Please note that while he is taking great care to ensure that all the information displayed here is correct, he cannot be made responsible for any factual errors that may occur. Under no circumstances is his employer in any way responsible for anything published on this site.